Unconditional security of coherent-state-based differential phase shift quantum key 
distribution protocol with block-wise phase randomization 
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We prove the unconditional security of coherent-state-based differential phase shift quantum key 
distribution protocol (DPSQKD) with block-wise phase randomization. Our proof is based on the 
conversion of DPSQKD to an equivalent entanglement-distillation protocol where the estimated 
phase error rate determines the amount of the privacy amplification. The generated final key has a 
contribution from events where the sender emits two or more photons, indicating the robustness of 
DPSQKD against photon-number-splitting attacks. 

PACS numbers: 



I. INTRODUCTION 



Since the first unconditional security proof of quantum 
key distribution (QKD) by Mayers [lj, quantum informa- 
tion theory has deepened our understanding on security 
that is guaranteed by quantum mechanics. One of the 
rigorous and intuitive security proofs is based on 

the conversion of a given QKD protocol to a mathemati- 
cally equivalent entanglement distillation protocol (EDP) 
@ , where the sender (Alice) and the receiver (Bob) distill 
qubit pairs in a maximally entangled state (Bell state). 
In this proof technique, the amount of the privacy ampli- 
fication is determined from the phase error rate of shared 
qubit pairs prior to distillation. Thus the estimation of 
the phase error rate is the central problem in this ap- 
proach. One of the difficulties in the estimation lies in 
the fact that the eavesdropper (Eve) may not attack on 
each pulse independently, but she may interact a train of 
pulses coherently with her single quantum system. Hence 
we are not allowed to assume that the state of the pairs 
shared by Alice and Bob are identically and indepen- 
dently distributed (i.i.d.). Various techniques have been 
proposed for solving this problem to treat the pairs as 
if they are almost i.i.d., such as the use of the random 
sampling theorem Q , its generalized version to quantum 
mechanics [||, Azuma's inequality and quantum De 

Finetti theorem [9j. With these techniques, we are able 
to focus on the statistics of a single pair, which greatly 
simplifies the proof. The security of many QKD proto- 
cols have been proven along this line [101 ]. 

There are QKD protocols, however, for which it seems 
to be difficult to prove the security with these techniques. 
Examples include differential phase shift QKD protocol 



(DPSQKD)[TT| and coherent one-way protocol (COW 
protocol) [12 1, which are in the family of the so-called 
phase distributed protocols. In these protocols, we em- 
ploy a train of pulses in coherent states and use the rel- 
ative phases between the adjacent pulses to encode the 
bit information of the key. The receiver can read them 
out simply by optically superposing two adjacent pulses 
by using a optical delay line. Despite this notable sim- 
plicity in the implementation, it has been expected that 
these protocols are robust against photon-number split- 
ting (PNS) attacks that have been found to be threats 
against many protocols using weak coherent laser pulses. 
On the other hand, the structure of encoding on every 
pair of adjacent pulses is rather a nuisance if one tries 
to prove the security of these protocols. Since the whole 
train of pulses are linked together by the phase relations, 
we are no longer allowed to work on each pulse separately, 
and we may have to work on a larger Hilbert space for the 
estimation of the phase error rate, which makes the secu- 
rity proof difficult So far, the security of DPSQKD 
with a single-photon source was proved in [3], but the 
robustness against PNS attacks cannot be deduced from 
the proof in which there are no events of multiple photon 
emission by the sender. 

In this paper, with no assumption on the attacks avail- 
able to an eavesdropper, we prove the security of DP- 
SQKD with trains of weak coherent pulses employing 
block-wise phase randomization, where Alice applies a 
common random phase shift on every pulse in a block of 
fixed number n of pulses. This allows us to use Azuma's 
inequality to cope with coherent attacks. As for Bob, we 
assume that he uses detectors that discriminate among 
the three cases of the vacuum, a single photon, and two 
or more photons. We calculate the final key rates numer- 
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ically as a function of channel transmission (distance be- 
tween Alice and Bob) and the observed bit error rate, and 
confirm the expected robustness of the DPSQKD proto- 
col against the PNS attacks. For the security proof, we 
introduce an EDP that is shown to be equivalent to the 
DPSQKD protocol, and pursue the relation between the 
bit error rate, which can be directly estimated, and the 
phase error rate, which determines a sufficient amount 
of privacy amplification to make the final key secure. 
Although the relevant Hilbert space for communication 
with n pulses is very large with its dimension exponen- 
tial in n, we will show that the symmetry in the protocol 
renders the relevant observables in a block diagonalized 
form, which allows us to work essentially on n-by-n ma- 
trices. 

This paper is organized as follows. In Sec. UH we de- 
scribe the DPSQKD protocol in detail and clarify the as- 
sumptions on the devices used by Alice and Bob. Then 
we introduce an alternative protocol (EDP-DPS) based 
on entanglement distillation and show that it is equiva- 
lent to the DPSQKD protocol. In Sec. lIIII we develop our 
security proof and explain how to calculate lower bounds 
on the secure key rate. Sec. II VI shows explicitly how the 
bit error and the phase error are related to each other, 
depending on the number of photons emitted from the 
sender. In Sec. [Vj we show numerical results on the key 
rates for various values of the channel transmission, the 
bit error rate, and the block length n. Then we summa- 
rize this paper in Sec. IVII 



II. DPSQKD AND ITS EQUIVALENCE TO 
EDP-DPS 



In this section, we first describe the protocol of DP- 
SQKD together with our assumptions on the photon de- 
tectors. We then argue that the DPSQKD protocol is 
equivalent to a protocol involving entanglement distilla- 
tion, which we call the EDP-DPS protocol. Throughout 
this paper, we use the following notations: 

P(|0»=|0>M (1) 
for vector \<j>) that is not necessarily unnormalized, and 
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for the Hadamard operator acting on a qubit. 



FIG. 1: Schematics of setup for DPSQKD. Alice sends out a 
train of coherent pulses after randomly applying a phase shift, 
either S or S + 7r, to each pulse. Here, 5 is a common offset 
randomly chosen between and 2ir. Bob uses a Mach-Zehnder 
interferometer (depicted as MZ) with a delay matched to the 
interval of the pulses, followed by photon detectors. We call 
the first beam splitter of MZ the shifting beam splitter, and 
the second one the interacting beam splitter. 



an appropriate timing (we call it j th time slot) tells Bob 
whether the relative phase shift between the neighboring 
pulses (j th and (j + l) th pulses) is or ir. We call the first 
beam splitter of the interferometer as the shifting beam 
splitter and the second beam splitter as the interacting 
beam splitter. 

Although the protocol described below regards a se- 
quence of n pulses as a block, the security analysis does 
not assume that the pulses outside of the block should be 
in the vacuum. Hence Alice has no need to introduce an 
optical shutter to extract a train composed of exactly n 
pulses, and her source may emit a indefinitely long train 
of pulses. 

Throughout this work, we assume that Bob uses 
photon-number-resolving detectors, which can discrim- 
inate among the vacuum, a single-photon, and multi- 
photons. As for the imperfections of the detectors, we 
assume that the inefficiency (a non-unit quantum effi- 
ciency) of a detector is modeled by a linear absorber 
followed by a perfect detector with unit quantum effi- 
ciency. We further assume that the two detectors have 
the same quantum efficiency. Then the inefficiency can 
be modeled by a common linear absorber placed in front 
of the interferometer, which may be under Eve's control. 
As for the dark countings of the detectors, we assume 
that they are statistically independent and uniform such 
that it is modeled by Eve's injection of spurious photons 
to the interferometer. Finally, we do not consider any 
side-channels. 



B. DPSQKD 



A. Setup of DPSQKD and assumptions 

The setup for DPSQKD uses a laser source emitting 
a long train of pulses and a phase shifter at Alice's site, 
and one-bit delay Mach-Zehnder interferometer followed 
by two photon detectors at Bob's site (see Fig. [T]). The 
interferometer introduces a delay equal to the interval 
of the neighboring pulses, such that photon detection at 



The protocol of DPSQKD runs as follows. 

(1) Alice generates a random n-bit sequence s = 
s\S2---s n and a random (common) phase shift d <E 
[0, 2n). She prepares a sequence of n pulses in the co- 
herent state ®" =1 \e lS (—l) Si a) i and sends them to Bob 
through a quantum channel. 

(2) Bob receives the n pulses and puts them into the 
shifting beam splitter followed by the interacting beam 
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FIG. 2: Schematics of Alice's quantum circuit. The inputs 
are the j th and (j + l) th qubits, which are subjected to a 
C-NOT gate followed by an Hadamard gate (H) on the j th 
qubit. The (j + l) th qubit is then measured on Z-basis (Mz)- 
If the measurement outcome is 0, a phase flip gate is applied 
to the j th qubit with probability 1/2, which is denoted by 
I/Z. If the outcome is 1, the j th qubit is left untouched. 



splitter. Then he performs photon detection by using 
the photon number resolving detectors. Let us call the 
event detected if he detects exactly one photon in j th (l < 
j < n — 1) time slot and detects the vacuum in all of the 
other n time slots (including the th and n th ones). If 
the event is not detected, Alice and Bob skip steps (3) 
and (4) below. 

(3) Bob takes note of the detected bit value and an- 
nounces the number j over the authenticated public chan- 
nel. 

(4) Alice takes note of the bit value Sj © 8j+\. 

(5) Alice and Bob repeat (1) thorough (4) TV times. 
Let QN be the number of the detected events. At this 
point, Alice and Bob should have their own records of 
QN bits. 

(6) Alice and Bob randomly select a small portion £ of 
the QN detected events, and compare the bit values over 
the public channel. This gives the estimate of the rate e 
and hence of the number eQN(l — £) of bit errors in the 
remaining portion. 

(7) Alice and Bob discuss over the public channel to 
perform error correction and privacy amplification on the 
remaining portion to share a final key of length GN(1 — 

0- 



C. Alternative procedures 

Here we consider equivalent ways of carrying out var- 
ious procedures appearing in the DPSQKD protocol, in 
order to reduce it to a protocol based on an entangle- 
ment distillation protocol (EDP). Suppose that Alice has 
a quantum register of n qubits. Let Ha = ®"=i Ha.,% be 
the Hilbert space for the n qubits, and define a state 

n 

\& s ) EE 2-/ 2 <g)(H \ Si ) A .) \e iS (-iy<a) i 

s i=l 

over the n qubits and the n optical pulses. Alice's pro- 
cedure at step (1) in the DPSQKD can be equivalently 
done by preparing state \<f>' s ) with random <5 and by ex- 
tracting s through a measurement on the n qubits. Al- 



ternatively, let us introduce an auxiliary system c with 
a Hilbert space spanned by an orthonormal basis {^}^L 
and define 

|$> EE 2-/ 2 J2 E \")c*» K-l) S< «)i - 

S U=0 2—1 

(3) 

where tt v is the projection onto the subspace for which 
the total photon number in the n optical pulses is v. Alice 
can carry out step (1) starting with state |$) instead of 
\$' s ) since 

i / 27r ^|$' 5 )(^|=Tr c |$) <*| 
27T Jo 

holds. 

What Alice eventually needs about the sequence s in 
the DPSQKD is the single bit value Sj © Sj+i in step 
(4). This bit can be alternatively extracted by applying 
a quantum circuit shown in Fig. [5] and measuring the 
output qubit (which is renamed as Aq) in the standard 
(Z) basis. Notice that the random phase flip conditioned 
on the outcome of the measurement on the other qubit 
has no effect on the Z-basis ({|0) , |l)}-basis) measure- 
ment. The action of the circuit is also described by a 
set of measurement operators {M 3 ' : Haj © W-Aj+i ^ 
HAq}k=i,2,3 defined as 



H\0) m {a^(0\aj+i(1\) 
+H\l) Aq ( Ad (1\aj+i <0|) 
1 

i 
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|0U q Ui <oU >j+ i (o| + ^-(iu J+1 (i|), 



AJ (l\A d+ l(M)- 

(4) 



As for Bob, he can determine whether the event is de- 
tected or not, prior to the determination of the detected 
time slot and the bit value. To do this, suppose that 
he sends only the I s * and the n th pulse to the shifting 
beamsplitters (see Fig. [3]). After the I s * pulse is split, 
one of the two halved pulses propagates toward the in- 
teracting beamsplitter of the I s * time slot, and let us call 
it the 1 st half pulse. Similarly, the n th half pulse goes 
to the one for the (n— l) th time slot. Bob then carries 
out the quantum nondemolition (QND) measurement of 
the total photon number among the 1 st half pulse, the 
n th half pulse, and the remaining (n — 2) original pulses 
(2 < i < n— 1). For the rest of the pulses, he finishes the 
measurement for the th and the n th time slots as in the 
DPSQKD. It is not difficult to see that the event should 
be detected if and only if the QND measurement reveals 
exactly one photon and both the th and the n th time 
slots are found in the vacuum. 

When the event is detected, the state of the n pulses 
after the QND measurement is contained in the subspace 
T-Lb spanned by n states, which we denote with 
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FIG. 3: An equivalent description of Bob's measurement ap- 
paratus. The branching arrows represent the splitting of a 
pulse by the shifting beam splitter of MZ in Fig. [TJ while the 
intersecting corresponds to the superposition at the interact- 
ing beam splitter. The dotted arrows represent the pulses 
split from the neighboring blocks. The QND measurement in 
the EDP-DPS is applied to the n pulses confined in the box 
designated as QND in the figure. Bob's quantum register B 
is also defined to be the single-photon subspace for these n 
pulses. 



i representing the position of the single photon (at the 
half pulse when i = 1, n and at the original pulse other- 
wise). Let us call this subspace as Bob's quantum register 
B. Determination of the detected time slot j and the bit 
value in DPSQKD is regarded as a generalized measure- 
ment on the register B. Let IL S be the POVM elements 
for the bit value s detected at the time slot j. Consid- 
ering the action of the beamsplitters, they are written 
as 



n,> = \p{V^\j)b + (-i) s y^+l|j + i) B 



for 1 < j ' < n — 1 with 



1, 



1/2 (2 < i < n- 1). 



(5) 



(6) 



This measurement can be further decomposed into two 
consecutive measurements. The first one is a filtering 
operation, which gives the outcome j and leaves a qubit 
%B(i- It is described by a set of measurement operators 
Fj : %b — ► "Hsq- The second one measures the qubit on 
the standard basis {|0) Bq , |l) Bq }. 

is equivalent to the POVM {Ilj tS j 



The entire procedure 



Tlj, s , which is satisfied by the following choice 
Fj = |l) Bq b (j| + ^JTiH |0) Bq B {j + 1| . (7) 



D. EDP-DPS 

The alternative procedures by Alice and Bob described 
above lead to the following protocol (EDP-DPS) that is 
equivalent to DPSQKD in terms of the security. 

(VI) Alice prepares the state |$) and sends the n pulses 
to Bob through a quantum channel. 



(V2) Bob receives the n pulses and carries out the QND 
measurement in Fig. [3] to test whether there is exactly 
one photon in total among the 1 st half pulse, the n th 
half pulse, and the remaining (n — 2) original pulses (2 < 
i < n — 1). He also tests whether both of the th and the 
n th time slot are in the vacuum. The event is detected if 
both of the tests are qualified. If the event is not detected, 
Alice and Bob skip steps (V3) and (V4) below. 

(V3) When the event was detected, Bob's quantum 
register B is measured with measurement operators {Fj}. 
He stores the output qubit Bq and announces the out- 
come j, which is the position of the detected time slot, 
over the authenticated public channel. 

(V4) Alice applies the quantum circuit in Fig. [5] to the 
j th and (j + l) th qubit of her quantum register A, and 
stores the output qubit Aq. She also measures system c 
to learn the total photon number v. 

(V5) Alice and Bob repeat (VI) through (V4) N times. 
Let QN be the number of the detected events. At this 
point, Alice and Bob should share QN pairs of qubits. 

(V6) Alice and Bob randomly select a small portion £ 
of the QN detected events, measures the qubits in the 
standard basis, and compare the bit values over the pub- 
lic channel. This gives the estimate of the rate e and 
hence of the number eQN(l — £) of bit errors in the re- 
maining portion. 

(V7) Alice and Bob discuss over the public channel to 
conduct entanglement distillation on the remaining qubit 
pairs, followed by the measurements on the standard ba- 
sis to agree on a final key of length GN(1 — £). 

Here the equivalence of steps (7) and (V7) follows from 
the discussion in [3j. The final key rate G is determined 
through the statistics of the occurrence of the phase error 
in the QN(1 — £) pairs in step (V7), which is analyzed in 
detail in the next section. 



III. SECURITY PROOF OF EDP-DPS 

In this section, we prove the security of EDP-DPS. Our 
proof is based on the Shor-Preskill security proof where 
Alice and Bob distill out a number of qubit pairs in a 
state whose fidelity to as many copies of the Bell state 
(|0) |0) + |1) \l))/y/2 approaches unity exponentially in 
the number of pairs. The key generated from the distilled 
state is then secure in the sense of composable security 
[l5j . According to Shor and Preskill, this virtual distil- 
lation protocol can be translated to error correction and 
privacy amplification schemes in the actual QKD proto- 
col to obtain a final key of the same security. The length 
of the final key is determined from the amount of error 
correction, which reflects the bit error rate, and from the 
amount of privacy amplification, which is related to the 
amount of phase errors in the qubit pairs before the dis- 
tillation. For simplicity, here we assume the asymptotic 
limit of large N in which £ is negligible, and the efficiency 
of the error correction reaches the Shannon limit. Then 
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the rate G of the final key per transmission of n pulses is 
written as 



G = Q \l - h (e) - fr (ph) 



(8) 



where h(x) = — a;log 2 x — (1 — x) log 2 (l — x). The number 
h(p h ) implies the entropy of the occurrence of phase er- 
rors, in the sense that the number of phase error patterns 
possible in the I = QN qubit pairs prior to distillation is 



given by 2 



Our goal is to determine an upper-bound 



on 

^(ph) from 

the bit error rate e and the detection rate 



A. Bit and phase error rates 

In order to see how the bit errors and the phase er- 
rors are related, we regard the occurrence of a bit or a 
phase error as an outcome of a measurement on Alice and 
Bob's quantum registers A and B just after the event is 
detected at step (V2), and write down the corresponding 
POVM elements. For the occurrence of a bit error from 
the time slot j, the POVM element is given by 



E 



P(H\s) Aj )P(H\ S ') A]+1 )fl 



(9) 



Here and henceforth, we omit identity operators on sub- 
systems, like the ones for Alice's (n— 2) irrelevant qubits 
in the above expression. The occurrence of a phase error 
is defined to be the case where Alice's qubit Aq and Bob's 
qubit Bq produce different outcomes when they are mea- 
sured on the X basis {H |0) , H |1}}. The corresponding 
POVM element is given by 

4 ph) = ^m^P(h\ S ) m )m^ ^^PiHis)^ 



E 



1 



H\0)a.i |0>. 



2' yi~/A,j l u /Aj+i/ 
® K j+s P(\j + S) B ),(10) 



where s = s ® 1 . It is convenient to introduce a unitary 
operator U acting on Ha ® Hb defined by 

n n 

U®(H \s t ,) A ll ) \i) B = (g)(ff \ Si ,) A>i ,) \i) B (ll) 

i' = l i' = l 

for 1 < i < n. Then it is straightforward to show that 

Uejff = £[,,!. (12) 
By using the relation 

up^aJHWb)^ - H\» o Sw^PMb) (13) 
we also have 

Uef*fr = \[P(\l) A<j )+P(\l) Ad+1 )} 

®[^P{\ 3 ) B ) + n J+1 P{\ ] + l) B )]. (14) 



By taking a sum over the time slots, we obtain the 
operators for the bit and phase errors as 



n—1 

S (ph) = g(ph) 



E' 



(15) 



When the state of Alice and Bob's quantum registers A 
and B just after the event is detected at step (V2) is p, 
the probability of having a bit error in the extracted qubit 
pair Aq and Bq is given by Tr(/3e). The probability of 
having a phase error is given by Tr(/5e( ph )). Through the 
operator U, these error operators are concisely written 
as follows. For the bit error, we have 



A 
n-1 



n = E^m, 

3=1 



(16) 
(17) 



where 1a is the identity operator acting on T-La- On 
the basis II is represented by a tri-diagonal real 

symmetric matrix. From Eq. ([5]), we have 

B (i\fl\i) B = 1/2 (l<t<n) (18) 
B {i\U\i + l) B = -1/(2V2) (i=l,n-l) (19) 
B {i\TL\i + l) B = -1/4 (2<i<n-2). (20) 

Notice that II > 0, and that n(JV °i V) b) = if and 
only if 



V2, 



C\ = C 2 



-1 = V2Cn- 



(21) 



The factor of y/2 comes from the fact that quantum reg- 
ister B is defined after the (i = 1) pulse and the (i = n) 
pulse are split in half. 

For the phase error, let us write the standard basis 
states of Alice's quantum register with n-bit sequence a = 
aia 2 ■ ■ . a n as \a) A = \ai) A1 \a 2 ) A 2 ' ' ' l a ")^,n- Tnen J us- 
ing Eqs. (HI) and (fl4|) . we have 



Vph) 



(22) 



with 



Tj(_Ph) 



<5ai,l <5a 2 



n-1 



E p (N 



-P(\n) 



^<H,1 ^a i+ i,l 



^0„-i,l . <5a„,l 



(23) 



On the basis II is tri-diagonal and nl ph ' ) is diag- 

onal. 
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B. Constraints on the state of quantum registers 

Since Alice's quantum register A and the system c 
never leave Alice, Eve can change their state only indi- 
rectly through controlling whether the event will be de- 
tected or not. As a result, if the initial state |<£>) has zero 
amplitude for a state vector \a) A \v) (($| \a) A \v) = 0), 
it stays so after the event is detected, namely, its density 
operator p satisfies p \a) A \v) — 0. The relation between 
a and v for the vanishing amplitude is derived as follows. 

The initial state |$) in Eq. ([3]) is written as 

oo n 

i$> = 2 -» e E \ v )c*» (gXK + (-!) ai 



!/=0 i=l 



(24) 



Since the state \a) — \—a) contains at least one photon, 
we have 



(s\ c (v\m = o if isi >i/, 



(25) 



where \a\ is the weight of the bit sequence a, namely, the 
number of l's in the sequence. Since the state \a) + \—a) 
always contains an even number of photons and \a) — | — a) 
contains an odd number of photons, we also have 



a (a\ c H I*) = o if (-1)1*1 ± (-iy. 



(26) 



Therefore, the state of Alice and Bob's quantum regis- 
ters after the event was detected and system c revealed a 
photon number v is contained in the range of projection 
operator defined as 



p(v) ^ E E^(I«)aWb) 

a:\a\-u.u— 2. u— A.... i=l 

The unitary U transforms this projection as 



UfMfr = P(\a) A )®l B 



(27) 



at\a\=u—X,i/—S,.. . 

+ E H\*>a)®Ps (28) 



with 



P 3 = J25 aitl P(\i) B ). 



(29) 



i=l 



C. Relation between the bit and phase errors 

The relation between the bit and phase errors can be 
conveniently expressed through the quantity fl^(X) for 
A > 0, which is defined as the largest eigenvalue of the 
operator 



(30) 



in the range of . The definition ensures that for any 
state p in the range of p( v >, the probability of a phase 
error is bounded as 



TrOSe (ph) ) < ATr(pe) + fiM(A) . 



(31) 



Suppose that at step (V5) of the EDP-DPS, Alice and 
Bob find NQqM pairs of qubits for which Alice has found 
the total photon number to be v at step (V4). Imagine 
one sequentially measures these qubit pairs in the Bell 
basis, one pair after another, to count the number of bit 
errors and phase errors. Regardless of Eve's attack, the 
above inequality is also true for the conditional probabil- 
ities of the occurrence of bit and phase errors in the m-th 
pair, conditioned on the outcomes for the (m — 1) pre- 
ceding pairs, since p is arbitrary. Then, using Azuma's 
inequality @, we are able to show @ that a similar in- 
equality holds for the total number NQq^'e^"' of the 
phase errors and the number NQq^e^ of the bit errors: 

e (p^)<Ae (l/) +n M (A)+e. 

When NQq^ gets larger with any fixed value of e > 0, 
the probability of this inequality to be violated decreases 
exponentially. Here and henceforth, we consider the limit 
of large N and we neglect e so that we assume 



,(pM) < Ae M + nM(A) 



(32) 



holds. 

The above inequality for various values of A deter- 
mines a convex achievable region of (eO),e(P h > w )), which, 
in principle, determines the convex achievable region of 
(e'"), h(e^ ph '^)) specified by a set of linear inequalities 



(33) 



for various values of 7 > 0. The amount of privacy am- 
plification /> h ) appearing in the key rate formula Eq. ([8]) 
is then bounded as 

00 00 
/j(ph) = y gM^ed*.")) < 7 e + V q^n^i-f) (34) 



u=0 



u=0 



for fixed values of {q^}- Here we have used the relation 
e = ^ u {'"'e'"' for the observed error rate e. The val- 
ues of {q^} are freely chosen by Eve under the obvious 
constraints from the number of total events where Alice 
has emitted v photons: 

(35) 



As long as the chain of inequalities 

fi (0) (A) < ft (1) (A) < (2) (A) < ••• (36) 

holds for all A > 0, Eve loses nothing by using the events 
with a larger value of v. Thus the optimal choice of {q^ v '} 
to maximize the right-hand side of Eq. (1341) is given by 



(v > Z/min + 1) 



l-Q _1 (l-E^Pv0 (^ = *W) (37) 

(V < ^min - 1), 
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where {p v } is the Poissonian distribution with mean na 2 , 



Pv 



and f m in is the integer satisfying 

l/ m i n ^min — 1 

1 - E p»' < *9 - 1 - E 

i/'=0 i/'=0 



(38) 



(39) 



On the other hand, the parameter 7 can be freely chosen 
to obtain the tightest bound. As a result, we formally 
obtain an upper bound on as 



h iph) < min 

7 



7e + E9 W *^(7) 



(40) 



In practice, the evaluation of fi^ (A) is involved for a 
large v, as shown in the next subsection. Hence, for the 
key rates calculated in this paper, we used a bound not 
as tight as Eq. ([4TJ]). essentially calculating fl^(X) up to 
v = 3. The technical detail of this bound is explained in 
Appendix A. 



D. Evaluation of fi M (A) 

Here we explain how to calculate the quantity il^(X) 
which is vital for determining the key rate. Since fi^^(A) 
is the largest eigenvalue of pM(e( ph ) — \e)P("' in the 
range of pM, it is also the largest eigenvalue of the op- 
erator 

UP^U^Ue^U^ - \UeU^)UP {v) U ] 

E P(\a) A )®(fi^-\n) 

a;\a\=u— 3,... 

+ E ^(l«>A)®^(nf l) -AH)F s , (41) 

a: |a|— i/+l 

in the range of Up^U\ where Eqs. (SJ, (22), and O 
are used. Since it is a direct sum over various operators 
specified by a, f2(")(A) is the largest among the eigen- 
values of these operators in the range 

of UpMui. Here 

we may neglect the operators with \a\ < v — 3, since the 
definition of f[l ph) in Eq. (|23J assures that fll ph) > ftl ph) 
if cii > o! i for all i. We thus conclude that is the 

larger of the two numbers f2^ (A) and Sl^ (A) defined as 

follows; Q_ (A) is the largest of the eigenvalues of the 
operators 



{nj> h > - All = *-!}. 



(42) 



Taking as the basis, one can calculate fl_ (A) by 

evaluating the largest eigenvalues of various tri-diagonal 
n x n matrices designated by n-bit sequences a with \a\ = 



v — 1. (A) is the largest of the eigenvalues of the 
operators 



{P s (u^ h > - ah)p s 



a = v 



1} 



(43) 



in the range of P$. Since n^ ph ' 1 — All is tri-diagonal, 

the off-diagonal element b (f^S^ ~ ^-0 \i) b vanishes 
when \i' — i\ > 2. Eq. (|2"3")l assures that the element 

b (nl ph ' ) — An) \i') B does not depend on when \i' — 
i\ > 2 and \i" — i\ > 2. We are thus allowed to focus 
on a subspace spanned by states \i) B with a; = 1 for 

consecutive values of index i. That is to say, Q+\\) is 
given by the largest of the eigenvalues of the operators 



{P a ,(ti^ h) ~\n)p s , 



a' = b u+k ,0 <k <v, 
1 <l,l + k<n} (44) 



in the range of Ps> , where a' = bi^+i means that a! i = 
for i < I or k + I < i, and a[ = 1 for I < i < I + k. 
One can thus calculate fi+^ (A) by evaluating the largest 
eigenvalues of various tri-diagonal (fc+1) x (fc+1) matrices 
with k < v. 

From a sequence a* and an eigenvector J+ c * \i) b cor " 
responding to the largest eigenvalue Sl^^(A), we can also 
reconstruct an optimal state of quantum registers AB 
that saturates the inequality (f3"Tj) . It is given by 



uH\c 



(45) 



where bi is the sequence for which = 1 and the only 
'1' is at the z-th bit, and the superscript * represents that 
Ci is optimal. 



IV. EXPLICIT RELATIONS BETWEEN THE 
BIT AND PHASE ERROR RATES 

In the last section, we showed that the final key rate 
can be determined from the knowledge of the relation 
between the bit error rate e^"> and the phase error rate 
e (ph,^) f or gg^h value of photon number v emitted by 
Alice. In this section, we explicitly calculate the allowed 
region of (e^\ e^ ph '^) up to v — 3 by evaluating the 
function Q^(A) analytically or numerically. 



A. Zero-photon part 

First we discuss the trivial case of v = 0, when Alice 
has emitted no photons. If we follow the prescription of 
the last section, fi(°)(A) = ^ 0) (A) since has no 

candidates for v = 0. In Eq. (|44|) , the choice a = bij 

results in B (l\ ni ph) \l) B = 1/2 and B (l\tl\l) B = 1/2 
regardless of I . Hence we have 



n<°)(A) = (l-A)/2, 



(46) 
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which corresponds to a single point (e(°), e( ph '°)) = 
(1/2,1/2). Physically, this is trivial since there should 
be no correlations in any basis in the shared qubit pair 
when Alice emitted no photons. 



B. Single-photon part 

In this subsection we consider the case v = 1, where 
a single photon was emitted from Alice. To calculate 
it is suffice to consider the cases \a\ = or \a\ = 

2. 

Since fl { S h) = for \a\ = 0, oL X) (A) is given by the 
largest eigenvalue of —All, which is zero. This corre- 
sponds to the point (e' 1 ^, e' ph ' 1 - ) ) = (0,0), implying that 
Eve has done nothing. 

When \a\ — 2 with at = <v = 1, it can be interpreted 
as Alice has emitted a photon in the i-th pulse and Bob 
has received a photon in the i'-th pulse, or vice versa. 
In either case, Eve's attack has moved the location of 
the single photon, which typically occurs when Eve tries 
to measure the relative phase between the two pulses. 
Mathematically, nontrivial choices in Eq. (|4"4")l are a' = 
hj+i, leading to (2 x 2) matrices 



1 U - 2A V2A 
4 1 v^A 3 - 2A 



1 /3 - 2A A 
4 V A 3 - 2A 



(47) 



for I = l,n — 1 and 2 < I < n — 2, respectively. The 
former matrix always has the largest of the eigenvalues, 
leading to fi^(A) = (7 - 4A + y/l + 8A 2 )/8. Combined 
with f2^' (A) = 0, we have 



Q«(A) 




Vl + 8A 2 )/8 

Q^(6) — yields an inequality 

e ( P h,D < 6e (D 



(A>6) 
(A < 6). 



(48) 



(49) 



which is saturated for < < 5/34 (0 < e^ 1 ) < 
15/17). Hence we have h(e^ h ^) < h(6e^) for 
< < 1/12. This is rewritten as h(e^ h ^) < 

6h'(6e)(e^ — e) + h(6e) for a constant e with < e < 
1/12, which gives the form of Clj^\ / y) in Eq. implic- 
itly as 



n^(7) = h(6e) - 7e for 7 = 6/i'(6e). 



C. Two-photon part 



(50) 



For the cases where Alice emitted two photons (u = 2), 

the evaluation of = max{f2^ ) (A),fi? ) (A)} in- 

volves calculation of the largest eigenvalues of n-by-n 
matrices, which we have done numerically. It has turned 
out that, irrespective of block size n, Q\ (A) is always 
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FIG. 4: (a) The upper bound on the phase error rate e' pl1 ' 2 ' 
as a function of the bit error rate e' 2 ' for the two-photon 
part. From top to bottom, the curves correspond to the case 
of n — 4, n = 7, and n = 9, respectively, (b) Magnification of 
the low bit error region. 



determined by the choice a = 11100 .. .0 among various 
values of a with \a\ = 3, while f2_ (A) is determined 

by a = 0100 ... which gives an eigenvalue no smaller 

(2) 

than any other a with \a\ = 1. Whether H, + (A) is larger 
(2) 

than f2_ (A) or not depends on A; With a constant Ao 
which is solely dependent on n, ^+ 2) (A) < fiL 2) (A) for 
A > A , while > fl^iX) for A > A > 0. As a 

result, the boundary of (e^ 2 \ e( ph ' 2 )) consists of two con- 

(2) 

vex curves determined from Q ± (A) and a straight line 
with slope Ao connecting them, which is shown in Fig. 
Ifor n = 4, 7, 9. Eve's best strategy is thus to use the 
subspace with a = 0100 ... for smaller values of and 
e (ph,2) (low-error regime), while she should mix it with 
the subspace with a — 1110 ... for achieving larger val- 
ues of e^ 2 ) and e^ pil ' 2 ' (high-error regime). We also see 
that as n gets larger, the bound on the phase error rate 
becomes tighter. 

In order to clarify the nature of Eve's optimal strategy, 
let us consider a state on Alice's and Bob's quantum 
registers AB, which is written in the form (see Eq. (|45[1 ) 



Ci a + b, 



(51) 



Fig. [5] shows the amplitudes {|ci| 2 } for examples of states 
achieving the maximal phase error in the low-error regime 
with a — 0100 ... 0. Mathematically, we see from Eq. (|2"3")l 



2 4 6 8 

1 "0"00 0.05 0.10 0.15 0.20 

Bit error rate 



FIG. 5: The optimal values of {\d\ 2 } for e (2) = 0.00010 (solid 
lines) and = 0.00655 (dashed lines), when n = 9. 

0.8 1 



0.6 




2 4 6 8 
i 

FIG. 6: The optimal values of {|c;j 2 } for e (2) = 0.06712 and 
n = 9. {ci} for i — 4,5, 6, 7, 8, 9 are exactly zero. The straight 
line in Fig. [4ja) is achieved by a mixture of this state and 
the state (with the higher error rate, depicted by the dashed 
line) shown in Fig. [5] 



that Eve wants to give larger weights on \c\\ 2 through 
| C3 1 2 to increase the phase error rate. On the other hand, 
as Eq. (f2"Tj) shows, she must keep {|ci| 2 } almost uniform 
in order to avoid the increase of the bit errors. As a 
result, for almost zero, the distribution {|ci| 2 } is al- 
most uniform, and it starts to cluster around i — 2 when 
e^ 2 ) increases. Note that the values at the edges |ci| 2 and 
| eg | 2 are halved due to the particular definition of Bob's 
quantum register B (see Fig. [3]). We may give a rough 
physical interpretation of this behavior as follows. The 
amplitude c, represents the event where Alice emitted a 
photon in the second pulse and another in the i-th pulse, 
and Bob received a photon in the i-th pulse. This means 
that Eve has stolen the photon in the second pulse in a 
PNS attack. Obviously, Eve gains nothing if Bob receives 
a photon far from the second pulse {i > 4), and so Eve 
should decrease the rate of such events as best as possible 
while keeping the bit error rate low. 

Similarly, optimal amplitudes for the high error regime 
is shown in Fig. [BJ The bit error rate is chosen for the 
point where the straight line in Fig. Ufa) meets the curve 

(2) 

specified by f2V(A). For a — 1110 .. .0, only ci, C2, and 
C3 can be nonzero, implying that the distribution is far 



FIG. 7: Color online: Comparison of the upper bounds on 
the phase error rates for one-, two-, and three-photon parts. 
The black, blue, and red solid curves are bounds for v = 
2, respectively corresponding to n = 4, n = 7, and n — 
9. The blue and red dashed curves are bounds for v — 3, 
respectively corresponding to n = 7, and n = 9. (All the 
region is achievable for n = 4 and v = 3.) The green curve 
represents the bound for v — 1, which is independent of n. 



from the uniform one and the bit error rate is high. As 
discussed in the case of v = 1, this can be understood 
as Eve tries to measure the relative phase between i = 1 
and i = 2 or between i = 2 and i = 3. 



D. Three-photon part and comparison 

The case for v — 3 can be calculated in a similar 
manner as for v = 2, and it was confirmed that the 
boundary is achieved by states with a = 11110 ... and 
a — 0110 ... 0, or a mixture of them. We compare the 
upperbounds on the phase error rate for v = 0, 1, 2, 3 (see 
Fig. [7|). The bound for v = 1 is independent of n. No 
bound is shown for n = 4 and v = 3 since all the region is 
achievable in this case. The achievable region for v = 
is a point (1/2, 1/2) and is not shown in the figure. This 
explicitly verifies fi(°)(A) < ftW(A) < fl^(X) < fl^(X) 
(see Eq. (36])). 



V. KEY GENERATION RATES 

In this section, we show examples of the key generation 
rates by using a model of the transmission channel. We 
assume an optical channel with linear losses, which are 
characterized by a single-photon transmission rate of rj. 
As a source of errors, we assume only alignment errors 
which lead to a constant error rate e for every time slot, 
regardless of the value of rj. With this model, we may use 
e directly in the theory, and the detection rate Q that we 
need for calculating the key rate is given by 

Q = (n-l)r ] a 2 e- {n+1)va2 , (52) 
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FIG. 8: Color online: The key generation rate as a function 
of r\ for (a) n = 4 and (b) n — 9. The bit error rate is 
set to e = 3%. The solid lines are the rates considering the 
contribution up to the three photon parts (77 — 3), and the 
dashed lines use only the single-photon part (77 = 1). The 
mean photon number per block no? is either 0.02 (black) or 
0.004 (red). 
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FIG. 9: The key generation rate as a function of r\ for n — 4 
and n = 9, with the mean photon number no 2 optimized for 
each value of rj. The bit error rate is set to e = 3%. The 
solid curves are the rates considering the contribution up to 
the two photon parts (77 = 2) , and the dashed curves use only 
the single-photon part (77 = 1). The two lower curves are for 
n = 4. 



reflecting the probability of (n — 1) time slots receiving 
one photon in total and 2 time slots receiving zero pho- 
ton. 

In Fig. [51 we plot the key generation rate for e = 3% 
and n = 4, 9 as a function of rj. We picked up two cases of 
the mean photon number of the pulses, no 2 — 0.004 and 
na 2 = 0.02. In each case, we apply two types of analyses 
to calculate the key rate. The first one is to consider 
the contribution from the single-photon, the two-photon, 
and the three-photon part, which we denote by V = 3. 
The other one is to consider contribution from only the 
single-photon part, which we denote by v = 1. The detail 
of each analysis is described in Appendix [5] We can see 
that for each n and na 2 , the key generation from 77 = 3 
is larger than the one from 77 = 1, which indicates the 
positive key generation from multiple photons. 

In order to assert that contribution from multi-photon 
parts do improve the key rate, we compare the key rates 
after the optimization over the mean photon number at 
each value of rj. For this purpose, we limit ourselves to the 
analysis up to the two-photon parts (F = 2), and compare 
the rates to those from the V = 1 analysis. The results for 
n = 4, 9 with e = 3% are shown in Fig. |H1 We see clearly 
that the rate from the 77 = 2 analysis exceeds the best 
rate from the V = 1 analysis, which confirms a positive 
contribution from the two-photon part. The ratio of the 
key rate for 77 = 2 to that for 77 = 1 is almost constant 
over 77, and is about 1.1 for n — 4 and 1.5 for n = 9. We 
have confirmed that the optimal mean photon number 
for each case increases almost linearly as r\ increases, i.e., 
na 2 = D(p)r] with a constant D(p) that depends on the 
types of analyses. The ratio D(p = 2)/ D(p = 1) is about 
1.4 for n — 9 and 1.1 for n = 4. Hence the inclusion of 
the two photon part in the analysis does not only give 
an extra portion of the key from the two-photon events, 
but also allows us to use more intense pulses to increase 
the detection rate itself to improve the key rate. 

When the error rate is lower than ~ 1%, the differ- 
ence between the rate from the multi-photon analysis and 
that from the single-photon analysis becomes more pro- 
nounced, as shown in the logarithmic plots in Fig. 1101 for 
n = 9. For e = 1%, the key rate shows an 0(rj 2 ) depen- 
dence when 77 is higher, and the case of 77 = 2 is better 
than the case of 77 = 1 by a constant factor. For this 
rate, the mean photon number is chosen as na 2 = 0{rj). 
This behavior is the same as that for e = 3%. But when 
n is lower, the rate starts to show an improved depen- 
dence of 0(i7 3 / 2 ). This is due to the fact that it is possi- 
ble to generate the final key solely from the two-photon 
events when e = 1%, and hence we have another option 
of choosing the mean photon number na 2 to be 0(y/rj), 
much higher than in the case of e = 3%. When e = 0.5%, 
the 0(r? 3 / 2 ) dependence already shows up at 77 as high as 
0.01, and the multi- photon rate is much higher than the 
single-photon rate. This types of behavior can be also 
analytically explained in the limit of r\ — > 0, which is 
given in Appendix |B| 
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FIG. 10: The key generation rate G for n = 9 as a function 
of transmission 77 when the error rate e is low, for e = 1% 
(left) and e = 0.5% (right). The solid curves are the rates 
considering the contribution up to the two photon parts (V = 
2), and the dashed curves use only the single-photon part 
(V = 1). For the dashed curves, the mean photon number 
no 2 is optimized to maximize the rate G. For the solid curves, 
the mean photon number is chosen as either na 2 = 0.09 8777 
or na 2 3* 0.0465^7? for e = 1%, and na 2 9£ 0.10507 for 
e = 0.5%. 



VI. SUMMARY AND DISCUSSION 



experiments. Similarly, our analysis does not take into 
account the detection rate for each time slot. Moreover, 
for the simplicity of analysis, we considered one-photon 
detection per block by Bob, and it will be interesting to 
consider multiple detection of a single photons in a block. 
We believe that the security proof that fully makes use 
of all of them improves the key generation rate, which 
we leave for future study. We hope that the ideas intro- 
duced this paper is useful for the security proof of the 
so-called COW protocol, which shares some similarities 
with DPSQKD. 
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In this paper, we have proved the unconditional se- 
curity of coherent-state-based DPS protocol with block- 
wise phase randomization. Thanks to the block-wise 
phase randomization, Alice's state is transformed to a 
classical mixture of states with fixed numbers of the total 
photons, which allows us to analyze each photon-number 
space separately. After the calculation of the bounds 
on the phase error rate for the single-photon part, the 
two-photon part, and the three-photon part, we showed 
behavior of the key generation rates assuming a simple 
channel model that accommodates losses and misalign- 
ment. 

The examples of the key generation rates first show 
that DPS with a weak coherent pulse train is able to 
produce a secret key with no assumptions on the ability 
of the eavesdropper. When the bit error rate is rela- 
tively large (about 3%), the key generation rate is pro- 
portional to 0(r/ 2 ) of the channel transmission 77. The 
multi-photon emission events contributes to the key rate 
as an improvement of a constant factor. When the bit 
error rate is small (about 1% or smaller), an improved 
scaling, 0(?7 3 / 2 ), of the key rate is observed, which im- 
plies the key can be generated solely from the two-photon 
emission events. These behaviors confirm the expected 
robustness of the DPSQKD protocol against the PNS at- 
tacks. 

We remark that our analysis does not fully exploit the 
available data. For instance, we have used the bit error 
rate averaged over the block for the security analysis, but 
the bit error rate for each time slot is also available in the 



Appendix A: Calculation of the key rate 

Here we describe the procedure we used to determine 
the key rates shown in Sec. [V] Instead of calculating the 
bound Eq. (|40p exactly, we used weaker bounds in which 
we neglect the contribution of the events where the pho- 
ton number v in Alice's pulse train is larger than a con- 
stant 77, namely, the contribution is considered up to 77 
photons. This was done by assuming 

n^\X) = 1 (1/ > i7+i), (Ai) 

which means that 

nST } (7) = l {v>V + l). (A2) 

These choices trivially satisfy Eqs. (j3"2")l and (|33p for any 
A > and 7 > 0. 

Three types of analyses, 77 = 1, 2 and 3, were used in 
Sec. El The condition of Eq. (131)1) is now written as 

O (0) (A) < ft (1) (A) < ... < ft (77 >(A) < 1, 

(A3) 

which was confirmed to be true in Sec. VB for 77 = 1,2, 3. 
This assures that, under the given values of Q and e, the 
maximum value of 

00 

fc(pi») =^g(")/ l ( e (PV')) (A4) 
v=0 
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is the same as the maximum value of 

oo 

= J2q {u) *h{e^ h '^), (A5) 

!/=0 

where {c? (l/) *} are defined in Eq. (|57|) . Let us define 

oo 

g <«/>*)» = q^*, (A6) 

l/=77+l 

and assume q^* — 0, which is satisfied by normally ob- 
served values of Q. Then we have 

77 

~ h (ph) < q {u>V)* + ^ q^*h{e^'^). (A7) 

We will then explain the evaluation of the right-hand side 
for each value of V. 

For V = 1, we use e > gW*e^ and Eq. (|4"9l to obtain 

fc(e< ph ' 1 >) < /i(6e/g (1) *) (A8) 

for 12e < <? (1) *. Hence we obtain 

/j(ph) < ? (i/>i)* +q ( 1 )*h(6e/q {1 >) (12c < (A9) 

For 17 = 2, we start from 

e (ph,2) <fi(2)( A) + Ae (2) ; (A1Q) 

we see that for any A > and e such that < (A) + 
Ae < 1/2, we have 

/i(e (ph < 2) ) < h(n {2 \\) + Ae) + 7 *(e (2) - e) (All) 

with 

j* = h'{il ( - 2 \X)+Xi)>0. (A12) 
Combining it with Eq. (|33p . we obtain 

? (i).^ e (ph,x)) + g (2)*/ l ( e (P h > 2 )) < /(A, e) (A13) 

with 

/(A,g)^ 7 *e + g (1) *4 1) (7*) 



with 



,(2)* 



/i(f)( 2 )(A) + Ae) — 7*e)j , (A14) 



which leads to a bound 

^(Ph) < /(A,g) + 9 (ly>2) * 



(A15) 



The evaluation of /(A, e) is not difficult since it is easy 
to calculate Q^\~f*) for a given numerical value of 7* 
through the use of Eq. (f5U| . In order to obtain the best 
bound, it is sufficient to try the following combinations, 



e±(A) = — lim 



(A17) 



A o ->A±0 d\o 

which is essentially a one-parameter family. 
For V = 3, we define 

? (2,3)* = q (2)* + ? (3)* ; 

r 2 = q^*/q^>, r 3 W 3) 7? (2 ' 3) * , 
e (ph,2,3) sr2e ( P h,2) +r . 3e (ph,3) ; 

e (2,3)^ r2e (2) +r3e (3) ; 

f>( 2 ' 3 >(A) = r 2 r»( 2 )(A) + r 3 f>( 2 >(A), (A18) 

and introduce another compromise in the key rate by the 
use of the inequality 

(? (2)^ (e (ph,2) ) + g (3). ft(e (ph,3)) < g (2,3)* /l(e (ph,2,3) )j 

(A19) 

which is not necessarily saturated. Starting from 

e (ph,2,3) <^(2,3) (A) + Ae (2,3) ; (A2Q) 

we can exactly follow the argument for V — 2, except that 
q^\ and q^ >2 > should be replaced with q^ 3 >, 

f^ 2,3 ), and g( y>3 )*, respectively. 



Appendix B: Limit of low channel transmission 

Here we discuss the behavior of the key rate in the limit 
of low channel transmission, r\ — ¥ 0. For comparison, first 
we consider the key rate under the assumption that only 
the single-photon events (y = 1) contribute the final key, 
namely, 



ft M (A) = 1 for v > 2. 



(Bl) 



In this case, the amplitude must be at most proportional 
to rj to mitigate the PNS attacks, resulting in a rate of 
raw key proportional to if . To investigate this quadratic 
behavior of the key, we introduce parameters as follows, 



a 2 = C 2 r\ 
G = D 2 r, 2 , 



(B2) 
(B3) 



where the subscript 2 implies the quadratic behavior. 
Taking only the dominant terms in the limit of rj — > 
in Eqs. ©, §7}, @D), ©, we have 



Q = (n-l)C 2V 2 

_ (1)* , (»« 2 ) 2 , 

V = q y ' =1 r^— = 1 



n 2 C 2 



{(A,e)|A > 0,e+(A) <e<e_(A)} 



(A16) 



(B4) 

2Q ' 2(n-l) (B5) 
D 2 = (n-l)C 2 { 2 /[l-4 1) ( 7 )]-7e-/i(e)},(B6) 

where we restrict the range of C 2 to be 

2(n- 1) 



< C 2 < 



(B7) 
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Setting 7 = 6h'(6e/y) and using Eqs. (|B5I) and (|50l) . we 
obtain 



Do 



2(n- l) 2 



(i-y) 



6c 

y - y/i ( — ) - ft(e) 



(B8) 



Hence Z?2 can be as large as the following quantity 
2(71 - l) 2 



max (1 - y) 



o<y<i 



, (B9) 



where the superscript 1 signifies the contribution from 
only the single-photon events. Let us define a constant 



e (1) 

t-m ax 



0.0375 by the equation 

1 - h(6e£l) - h(e£l) = 0. 



(BIO) 



For e < emax, (n, e) > and we have a positive key 
rate G = D^\n, e)r/ 2 . 

Next, let us include the contribution from the two- 
photon events (y — 2) by using fl^(X) calculated 

in Sec. IIV CI and f2? (7) that can be calculated from 
fi( 2 )(A). In this case, we have 

2(n- l) 2 



Do 



+(l-y)[l-4 2) (7)]- 7 e-Me)}. (Bll) 
As a function of ?/, D2 is maximal at ?/ = y*(7) with 



*, x l-/i(e)-7e-fil 1) (7) 

v (7) = 1 — , L, / „ m fe (B12) 



2[0l 2j (7)-0^(7) 

when < t/*(7) < 1. For n > 11, let e = 
solution of the following set of equations, 

i_ fe(e) - 7e _ w (7) = i 

2[0l 2) ( 7 )-4 1) (7)] 

^i 2) (7) 
c?7 



,(1,2) 



be the 



(B13) 



(B14) 



which depends on n. For n < 10, there is no positive 

0. Then it can be shown that 



solution and let 



for e| I J i ' 2 ' 1 < e < eUL, we have a positive key rate G = 
D^ 1,2 ^(n, e)?? 2 with 



D 



(1,2) 



(n,e) 



(n-1) 2 



max [1 - y* (7)] [1 - fc(e) - 7 e - (7)] 

7>0:0<y*(7)<l 

(B15) 

where it should be noted that fi^ ; (7) depends also on 

(12) 

n. For e < , there is no maximal point of C2 in the 
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FIG. 11: Comparison of the key rates in the limit of low 
transmission r\ — > 0, when the contribution from two-photon 
emission events are taken into account (the dashed curves) or 
not (the dotted curves). When the total mean photon number 
na 2 of the n pulses is chosen to scale as 0(ri) , a key rate of G = 
0(r] 2 ) is achievable. If we assume that the key is contributed 
only from the events where Alice has emitted a single photon, 



D2 (n,e)ri , with the coefficient 



the key rate scales as G 

When we include the contribution from the events where Alice 
has emitted two photons, the key rate is improved to G ~ 



'2 

D\ L> (n, e) being plotted as dotted curves for n = 4 and 9 



D 2 ' (n, e)r] , and the coefficient D 2 ' (n, e) is shown as the 
dashed curves. 



range of Eq. (|B7[) and the key rate increases indefinitely 
with C2, implying that the scaling is better than 0(rj 2 ), 
which will be confirmed below. The comparison between 
D^\n, e) and D^' 2 \n, e) for n = 4, 9 is shown in Fig.lTTl 
The ratio D^' 2 ^ /D^' is only weakly dependent on the bit 
error rate e and approximately 1.1 and 1.5 for n = 4 and 
n = 9, respectively. 

When the bit error rate is as small as ~ 1%, it is also 
possible to extract the key solely from the two-photon 
part. This means that a 2 is no longer required to be 
proportional to rj. Instead, we may obtain a positive key 
rate with a higher amplitude as 



G 



C 3/ 2V 1/2 
D 3/ 2V 3/2 , 



(B16) 
(B17) 



with an improved dependence on the channel transmis- 
sion rj. For simplicity, we still ignore the contribution 
from the events with v > 3, namely, we assume 



fi M (A) = 1 for v > 3. 



(B18) 



Assuming Cy 2 < 6(n- 



l)/n 3 and taking dominant terms 
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FIG. 12: Coefficients of the key rate G in the limit of low 
transmission r\ — ¥ 0. By choosing the total mean photon 
number na 2 of the n pulses to scale as 0(t]), a key rate of 



G ~ D. 



(1,2), 



2 (n, e)r\ is achievable. The coefficient D 2 



(1,2) 



(n,e) 

is shown for n = 4, 9 as the broken curves. When e is small, it 
is also possible to choose not 2 — 0(^/ff), resulting in a better 
scaling of the key rate as G ~ D^ 2 (n, e)n 3 ^ 2 . The coefficient 
£>gy 2 (n, e) is shown for n = 4, 9 as the solid curves. 



in the limit of 77 — >• 0, we have q^* = and 
Q = (n - l)C 3/2 7? 3 / 2 
z = q 

n — 1 



3 C 2 



3/2 



D 



3/2 



= \/6 



6g 

3/2 



6(n - 1) 



(B19) 
(B20) 



(1-z) 1 / 2 x 



{z[l-^ 2) ( 7 )]- 7 e-M e )}- (B21) 



As a function of z, -D3/2 is maximal at z — 2* (7) with 



z*( 7 ) = l- 



l-ft(e)-7e-fli J, (7) 



3[l-«i 2) (7)] 



(B22) 



when < 2* (7) < 1. Let e = emai(n) be the solution of 
the following set of equations, 



l_fc(e)_ 7e _ n «( 7 ) 

^1 2) (7) 
c?7 



-e, 



(B23) 
(B24) 



which depends on n. Examples of the values are 
eSL(4) = 0.0041 and ei 2 L(9) = 0.0112. Then, for e < 
emL(n), we have a positive key rate G = D^J 2 (n, e)rf^' 2 



with 



D f/2 ("> e ) = ^ ' ' 



3/2 



max [l-z*( 7 )] 1/2 [l-Me)-7e-^ 2) (7)]. 

7>0:0<y*(7)<l 

(B25) 



In Fig.dl D^ 2 (n,e) and D^'(n,e) are shown for n = 4 



and n = 9. 
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